[rpms/corosync] f45: Fix CVE-2026-81666 and CVE-2026-81665

[rpms/corosync] f45: Fix CVE-2026-81666 and CVE-2026-81665

[Jan Friesse]

            A new commit has been pushed.

            Repo   : rpms/corosync
            Branch : f45
            Commit : cf84dab38ec5b290528cef245e2bfd4c4d2ba148
            Author : Jan Friesse <jfriesse@redhat.com>
            Date   : 2026-09-04T11:24:27+02:00
            Stats  : +105/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/corosync/c/cf84dab38ec5b290528cef245e2bfd4c4d2ba148?branch=f45

            Log:
            Fix CVE-2026-81666 and CVE-2026-81665

- totemsrp: Fix int overflow in commit_token_sanity
  (fixes CVE-2026-81666)
- totempg: Replace assert with check in deliver_fn
  (fixes CVE-2026-81665)

- Resolves: rhbz#2528437

Signed-off-by: Jan Friesse <jfriesse@redhat.com>

---
diff --git a/0001-totemsrp-Fix-int-overflow-in-commit_token_sanity.patch b/0001-totemsrp-Fix-int-overflow-in-commit_token_sanity.patch
new file mode 100644
index 0000000..457716c
--- /dev/null
+++ b/0001-totemsrp-Fix-int-overflow-in-commit_token_sanity.patch
@@ -0,0 +1,50 @@
+From 83920f2e36b5f1acd7dcf033c0820043cc29f82a Mon Sep 17 00:00:00 2001
+From: Jan Friesse <jfriesse@redhat.com>
+Date: Wed, 2 Sep 2026 15:08:31 +0200
+Subject: [PATCH 1/2] totemsrp: Fix int overflow in commit_token_sanity
+
+This commit addresses an integer overflow (wraparound) vulnerability
+in the check_memb_commit_token_sanity function.
+
+Previously, on 32-bit systems, a large unsigned network value for
+addr_entries (>= 153391690) could cause an integer overflow when
+multiplied by the sizes of the srp_addr and memb_commit_token_memb_entry
+structures. This wraparound resulted in a required_len that was smaller
+than the actual required memory size, potentially bypassing the
+subsequent message length bounds check.
+
+To fix this, we now reject the message if addr_entries exceeds
+PROCESSOR_COUNT_MAX before any multiplication or addition occurs.
+
+Fixes: CVE-2026-81666
+
+Reported-by: Tristan Madani <tristan@talencesecurity.com>
+Signed-off-by: Jan Friesse <jfriesse@redhat.com>
+Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
+Reviewed-by: Fabio M. Di Nitto <fdinitto@redhat.com>
+---
+ exec/totemsrp.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/exec/totemsrp.c b/exec/totemsrp.c
+index 67596911..1802bb34 100644
+--- a/exec/totemsrp.c
++++ b/exec/totemsrp.c
+@@ -3829,6 +3829,14 @@ static int check_memb_commit_token_sanity(
+ 		addr_entries = swab32(addr_entries);
+ 	}
+ 
++	if (addr_entries > PROCESSOR_COUNT_MAX) {
++		log_printf (instance->totemsrp_log_level_security,
++		    "Received commit_token message addr_entries exceeds the maximum "
++		    "allowed value...  ignoring.");
++
++		return (-1);
++	}
++
+ 	required_len = sizeof(struct memb_commit_token) +
+ 	    (addr_entries * (sizeof(struct srp_addr) + sizeof(struct memb_commit_token_memb_entry)));
+ 	if (msg_len < required_len) {
+-- 
+2.51.1
+

diff --git a/0002-totempg-Replace-assert-with-check-in-deliver_fn.patch b/0002-totempg-Replace-assert-with-check-in-deliver_fn.patch
new file mode 100644
index 0000000..7f5e746
--- /dev/null
+++ b/0002-totempg-Replace-assert-with-check-in-deliver_fn.patch
@@ -0,0 +1,46 @@
+From 5148bf07dffa61bcfa92ca2c058e7d0f0a981cf3 Mon Sep 17 00:00:00 2001
+From: Jan Friesse <jfriesse@redhat.com>
+Date: Wed, 2 Sep 2026 15:53:33 +0200
+Subject: [PATCH 2/2] totempg: Replace assert with check in deliver_fn
+
+If assert() is compiled out in release builds, a
+new message could be appended past the end of the assembly buffer,
+resulting in a buffer overflow.
+
+To prevent this, replace the assertion with a standard runtime bounds
+check. If the incoming message exceeds the maximum buffer size, it is
+now safely logged and ignored.
+
+Fixes: CVE-2026-81665
+
+Reported-by: Tristan Madani <tristan@talencesecurity.com>
+Signed-off-by: Jan Friesse <jfriesse@redhat.com>
+Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
+Reviewed-by: Fabio M. Di Nitto <fdinitto@redhat.com>
+---
+ exec/totempg.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/exec/totempg.c b/exec/totempg.c
+index d9beb899..b086bad9 100644
+--- a/exec/totempg.c
++++ b/exec/totempg.c
+@@ -659,7 +659,14 @@ static void totempg_deliver_fn (
+ 		return ;
+ 	}
+ 
+-	assert((assembly->index+msg_len) < sizeof(assembly->data));
++	if (assembly->index + msg_len >= sizeof(assembly->data)) {
++		log_printf(LOG_WARNING,
++		    "Message (totempg_mcast) received from node " CS_PRI_NODE_ID
++		    " would create too long message of %u bytes...  Ignoring.",
++		    nodeid, assembly->index + msg_len);
++
++		return ;
++	}
+ 	memcpy (&assembly->data[assembly->index], &data[datasize],
+ 		msg_len - datasize);
+ 
+-- 
+2.51.1
+

diff --git a/corosync.spec b/corosync.spec
index ac51c15..bc49986 100644
--- a/corosync.spec
+++ b/corosync.spec
@@ -17,7 +17,7 @@
 Name: corosync
 Summary: The Corosync Cluster Engine and Application Programming Interfaces
 Version: 3.1.10
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: BSD-3-Clause
 URL: http://corosync.github.io/corosync/
 Source0: https://github.com/%{name}/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.gz
@@ -25,6 +25,8 @@ Source0: https://github.com/%{name}/%{name}/releases/download/v%{version}/%{name
 Patch0: 0001-totemsrp-Return-error-if-sanity-check-fails.patch
 Patch1: 0002-totemsrp-Fix-integer-overflow-in-memb_join_sanity.patch
 Patch2: 0001-Enforce-encryption-at-compile-time.patch
+Patch3: 0001-totemsrp-Fix-int-overflow-in-commit_token_sanity.patch
+Patch4: 0002-totempg-Replace-assert-with-check-in-deliver_fn.patch
 
 # Runtime bits
 # The automatic dependency overridden in favor of explicit version lock
@@ -301,6 +303,12 @@ network splits)
 %endif
 
 %changelog
+* Fri Sep 04 2026 Jan Friesse <jfriesse@redhat.com> - 3.1.10-8
+- totemsrp: Fix int overflow in commit_token_sanity
+  (fixes CVE-2026-81666)
+- totempg: Replace assert with check in deliver_fn
+  (fixes CVE-2026-81665)
+
 * Tue Aug 04 2026 Jan Friesse <jfriesse@redhat.com> - 3.1.10-7
 - Enforce encryption at compile time